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(b) 

(c) 
(d) 



Amended claims follow: 

, . (Currently Amended) A method for protecting a computer in an opened share 

mode, comprising: 

(a) running a computer on a network in an opened share mode, wherem the 

opened share mode indicates a file structure parameter and a name parameter 
and applies only to a manually selected list of at least one of applicat.on 

programs and data; 

monitoring attempts to access the computer by applications utilizing the 
network, using the file structure and name parameter; 
determining whether the applications attempt to modify the computer; and 
executing a security event in response to any attempt to modify the 
computer; 

wherein the opened share mode indicates a plurality of parameters that are 
randomly selected to prevent detection nf virility of the parameters ; 
wherein the computer is run in an actual opened share mode and a virtual 
opened share mode such that the at least one of application programs and 
data is accessible in the actual opened share mode, and attempted access to 
the at least one of application programs and data associated with the virtual 
opened shared mode prompts a security process; 

th* ^uritv pr o ™« ^"des temporarily logging off the network, 
^^in p in a record information on any att e mpt to modify the compu ter 
,^,^; M fT ti.^ a nri .ourc e inflation, logrinir the computer back on the 
„^ r y in „ mode ot b~ than the actual opened share mode , transmitting the 
ir *~~-^n t " ■ *™ ™*v- '"^whether " tmwl is -found indicative 

nf HinatpH attack, and ™Hi„ r an alert anrt lorrinp a n.lpahle computer 

nffthe network hased on th* determination. 
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(Original) The method as recited in claim 1, wherein the opened share mode 
allows other computers on the network to access data stored on the 



computer. 



3. (Cancelled) 

4. (Previously Presented) The method as recited in claim 1, wherein the virtual 
opened share mode indicates to other computers of an ability to write to the 
computer. 



5. (Cancelled) 

6. (Cancelled) 

7. (Cancelled) 

8. (Cancelled) 



9. (Cancelled) 

10. (Original) The method as recited in claim 1, wherein the opened share 
applies to each of a plurality of networks of which the computer is a 
member. 

11. (Cancelled) 



12. (Cancelled) 

13. (Cancelled) 
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14. (Original) The method as recited in claim 1, wherein the computer is run on 
the network in a plurality of opened share modes. 

15. (Original) The method as recited in claim 1, wherein any attempt to modify 
the computer is utilized in a heuristic analysis for identifying a coordinated 
attack on multiple computers. 

16. (Original) The method as recited in claim 1, wherein attempts to modify the 
computer are tracked. 

17. (Original) The method as recited in claim 1, wherein it is determined whether 
the applications attempt to write to memory in the computer, and the security 
event is executed in response to any attempt to write to memory in the 
computer. 

18. (Original) The method as recited in claim 1, wherein it is determined whether 
the applications attempt to copy a virus to memory in the computer, and the 
security event is executed in response to any attempt to copy the virus to 
memory in the computer. 

19. (Original) The method as recited in claim I, wherein the security event 
includes logging the computer off the network in response to any attempt to 
modify the computer. 

20. (Original) The method as recited in claim 1, wherein the security event 
includes terminating the application attempting to modify the computer. 

2 1 . (Original) The method as recited in claim 1, wherein the security event 
includes deleting the application attempting to modify the computer. 
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22. (Original) The method as recited in claim 1 , wherein the security event 
includes an alert transmitted via the network. 

23. (Original) The method as recited in claim 22, wherein the alert includes 
information associated with the application attempting to modify the 
computer. 

24. (Currently Amended) A computer program product for protecting a computer 
in an opened share mode, comprising: 

(a) computer code for running a computer on a network in an opened share 
mode, wherein the opened share mode indicates a file structure parameter 
and a name parameter and applies only to a manually selected list of at least 
one of application programs and data; 

(b) computer code for monitoring attempts to access the computer by 
applications utilizing the network, using the file structure and name 
parameter; 

(c) computer code for determining whether the applications attempt to modify 
the computer; and 

(d) computer code for executing a security event in response to any attempt to 
modify the computer; 

wherein the opened share mode indicates a plurality of parameters that are 
randomly selected to prevent Het ft r.tinn nf a virtualitv of the parameters; 
wherein the computer is run in an actual opened share mode and a virtual 
opened share mode such that the at least one of application programs and 
data is accessible in the actual opened share mode, and attempted access to 
the at least one of application programs and data associated with the virtual 
opened shared mode prompts a security process; 

wherein the security process includes t e mporarily logging off the networ k, 
recording in a record information on anv attempt t o modify the computer 
including time and source information, logging the computer back on the 
network in a mode other than the actual o pened share mode, transmitting the 
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information to a third party, determining whether a trend is foun d indicative 
Qf a coordinated attack and sending an alert and logging a culpable computer 
off the network based on the determination . 

25. (Original) The computer program product as recited in claim 24, wherein the 
network includes the Internet. 

26. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode allows other computers on the network to access data 
stored on the computer. 

27. (Cancelled) 

28. (Previously Presented) The computer program product as recited in claim 24, 
wherein the virtual opened share mode indicates to other computers of an 
ability to write to the computer. 

29. (Cancelled) 

30. (Cancelled) 

31. (Cancelled) 

32. (Cancelled) 

33. (Cancelled) 

34. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode applies to each of a plurality of networks of which the 
computer is a member. 
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35. (Cancelled) 

36. (Cancelled) 

37. (Cancelled) 

38. (Original) The computer program product as recked in claim 24, wherein the 
computer is run on the network in a plurality of opened share modes. 

39. (Original) The computer program product as recited in claim 24, wherein any 
attempt to modify the computer is utilized in a heuristic analysis for 
identifying a coordinated attack on multiple computers. 

40. (Original) The computer program product as recited in claim 24, wherein 
attempts to modify the computer are tracked. 

41 . (Original) The computer program product as recited in claim 24, wherein it is 
determined whether the applications attempt to write to memory in the 
computer, and the security event is executed in response to any attempt to 
write to memory in the computer. 

42. (Original) The computer program product as recited in claim 24, wherein it is 
determined whether the applications attempt to copy a virus to memory in 
the computer, and the security event is executed in response to any attempt to 
copy the virus to memory in the computer. 

43. (Original) The computer program product as recited in claim 24, wherein the 
security event includes logging the computer off the network in response to 
any attempt to modify the computer. 
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44. (Original) The computer program product as recited in claim 24, wherein the 
security event includes terminating the application attempting to modify the 
computer. 

45. (Original) The computer program product as recited in claim 24, wherein the 
security event includes deleting the application attempting to modify the 
computer. 

46. (Original) The computer program product as recited in claim 24> wherein the 
security event includes an alert transmitted via the network. 

47. (Original) The computer program product as recited in claim 46, wherein the 
alert includes information associated with the application attempting to 
modify the computer. 

48. (Original) The computer program product as recited in claim 24, wherein at 
least a portion of the computer code resides on a gateway. 

49. (Original) The computer program product as recited in claim 48, wherein the 
security event includes blocking access to the computer. 

50. (Currently Amended) A system for protecting a computer in an opened share 
mode, comprising: 

(a) logic for running a computer on a network in an opened share mode, wherein 
the opened share mode indicates a file structure parameter and a name 
parameter and applies only to a manually selected list of at least one of 
application programs and data; 

(b) logic for monitoring attempts to access the computer by applications utilizing 
the network, using the file structure and name parameter; 

(c) logic for determining whether the applications attempt to modify the 
computer; and 
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(d) logic for executing a security event in response to any attempt to modify the 
computer; 

wherein the opened share mode indicates a plurality of parameters that are 
randomly selected to prevent detectio n of a virtual itv of the pa rameters: 
wherein the computer is run in an actual opened share mode and a virtual 
opened share mode such that the at least one of application programs and 
data is accessible in the actual opened share mode, and attempted access to 
the at least one of application programs and data associated with the virtual 
opened shared mode prompts a security process; 

wherein the security process includes temporarily loggin g off the network. 
recording in a record information on any attempt to modify the c omputer 
including time and source information* logging the computer ba ck on the 
network in a mode other than the actual opened share mode, transmitting the 
information to a third party, determining whether a trend is found indicative 
of a coordinated attack, and sending an alert and logging a culpable computer 
off the network based on the determination . 

5 1 . (Currently Amended) A method for protecting a computer in an opened share 
mode, comprising: 

(a) running a computer on a network in a virtual opened share mode and an 
actual opened share mode, wherein the virtual opened share mode allows 
other computers on the network to access predetermined data and programs 
resident on the computer, and indicates to other computers of an ability to 
write to the computer, and the actual opened share mode indicates a file 
structure parameter and a name parameter that are capable of actually being 
accessed by the other computers, and applies only to a manually selected list 
of at least one of application programs and data; 

(b) monitoring attempts to access the computer by applications utilizing the 
network, using, at least in part, the file structure and name parameter; 

(c) determining whether the applications attempt to modify the computer; 
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(d) tracking the attempts of the applications to modify the computer's]; 

(e) transmitting an alert via the network in response to any attempt to modify the 
computer, wherein the alert .includes information associated with the 
applications attempting to modify the computer; 

(f) logging the computer off the network in response to any attempt to modify 
the computer; and 

(g) deleting any application attempting to modify the computer; 

(h) wherein any attempt to modify the computer is utilized in a heuristic analysis 
for identifying a coordinated attack on multiple computers; 

n\ wherein information on »nv attempt to modify the computer including time 

and source information is r ecorded in a record; 
()\ wherein th* r^mnuter is »nf, P ed hack on the network in a mode other than the 

a ^,, fl l o pened share nrn He prior to performing the heuristic analysis for 

iriAntif yino the coordi™*^ attack an rf nt least one computer is logged off the 

network based on heur istic analysis: 
(ik) wherein (d)-0»j) are carried out if it is determined that the applications 

attempt to modify the computer via the virtual opened share mode; and 

access is permitted if it is determined that the applications attempt to modify 

the computer via the actual opened share mode; 

wherein the parameters are randomly selected to prevent detectionofa 

virtualitv of the parameters . 

52. (Currently Amended) A computer program product for protecting a computer 
in an opened share mode, comprising: 

(a) computer code for running a computer on a network in a virtual opened share 
mode and an actual opened share mode, wherein the virtual opened share 
mode allows other computers on the network to access predetermined data 
and programs resident on the computer, and indicates to other computers of 
an ability to write to the computer, and the actual opened share mode 
indicates a file structure parameter and a name parameter that are capable of 
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(e) 



(0 



actually being accessed by the other computers, and applies only to a 
manually selected list of at least one of application programs and data; 

(b) computer code for monitoring attempts to access the computer by 
applications utilizing the network, using, at least in part, the file structure and 
name parameter; 

(c) computer code for determining whether the applications attempt to modify 
the computer; 

(d) computer code for tracking the attempts of the applications to modify the 
computer[s]; 

computer code for transmitting an alert via the network in response to any 
attempt to modify the computer, wherein the alert includes information 
associated with the applications attempting to modify the computer; 
computer code for logging the computer off the network in response to any 
attempt to modify the computer; and 
(g) computer code for deleting any application attempting to modify the 
computer; 

wherein any attempt to modify the computer is utilized in a heuristic analysis 
for identifying a coordinated attack on multiple computers; 
wherein information nn any attem pt to modify the computer including time 
and source information is recorde d in a record; 
ftt wherein the computer is logged hack on the network in a mode other than the, 
■rhMl o pened share mode prior t o performing the heuristic analysis for 
ifWifvin ? the coordinated attac k and at least one computer is logged off the 
network based on heuristic analysis; 
(ik) wherein (d)-(hj) are carried out if it is determined that the applications 
attempt to modify the computer via the virtual opened share mode; and 
access is permitted if it is determined that the applications attempt to modify 
the computer via the actual opened share mode; 

wherein the parameters are randomly selected to prevent detectionofa 
virtualitv of the parameters . 



(h) 
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53. (Previously Presented) The method as recited in claim 1, wherein the file 
structure includes a tree structure. 

54. (Cancelled) 

55. (Cancelled) 
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